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Anonymous Veto (AV) and Dining cryptographers (DC) are two basic primitives for the crypto¬ 
graphic problems where the main aim is to hide the identity of the senders of the messages. These 
can be achieved by classical methods where the security is based either on computational hardness 
or on shared private keys. In this regard, we present a secure quantum protocol for both DC and 
AV by exploiting the GHZ correlations. We first solve a generalized version of the DC problem with 
the help of multiparty GHZ state. This allow us to provide a secure quantum protocol for the AV. 
Securities for both the protocols rely on some novel and fundamental features of GHZ correlations 
related to quantum nonlocality. 
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I. INTRODUCTION 

In the classical world, where any physical transmis¬ 
sion can be traced to its origin, it seems impossible to 
setup a secure way for message transmission without re¬ 
vealing its senders’ identity. Dining cryptographers (DC) 
problem [I| introduced by Chaum is one of the primary 
attempts in this context. In a DC problem, three cryp¬ 
tographers are curious to find out whether their agency 
NSA (U.S. National Security Agency) or one of them 
pays for the dinner. At the same time they respect each 
other’s right to make an anonymous payment. A general¬ 
ized version of the DC problem called DC-net where one 
of the member from an agency publicizes a secret message 
without revealing his identity [l| . An unconditionally se¬ 
cure DC-net requires pairwise shared (secure) keys and 
an authenticated broadcast channel. Since, the security 
of DC-net relies on the generation of secure key between 
pairs of members so it is not unconditionally secwr^ if 
members are not allowed to pre-share bilateral private 
keys. Another major flaw of DC problem is that, it is 
vulnerable against multiple payments. It shows zero pay 
i.e. no transmission of message if even number (0,2,...) 
of members pay for the dinner and detects payment if 
an odd (1, 3,...) number of members pay for the dinner. 
There is another loophole in DC problems called collu¬ 
sion loophole where some of the participants may coop¬ 
erate among them to trace the person who pays. There 
are some works that partially resolve the problem with 
multiple payments and the collusion problem but none of 
them provides an unconditionally secured solution M- 

Another variant of DC problem known as Anonymous 
Veto (AV) problem Q. Here a group of jury members, 
who need to take an unanimous decision, but at the same 
time want their individual decisions to remain secret i.e. 


without ever disclosing the identity of possible vetoing 
member(s). This could be very important in many as¬ 
pects of human societies. Security of the classical solution 
of this problem is also based either on the computational 
hardness like other classical cryptographic protocols or 
on inmosing restrictions on the number of dishonest play¬ 
ers 0. In this context, Boykin Q provided a quantum 
protocol to send classical information anonymously by 
distributing pairwise shared EPPlpair^ among players. 
In 2005, Christandl and Wehner proved that the pro¬ 
tocol presented by Boykin is not perfectly secure since it 
does not satisfy the traceless property and they provided 
an alternative quantum scheme of the DC-type problem 
with the traceless feature. In this regard, we present se¬ 
cure quantum protocol for both DC and AV problems 
with the help of multi-qubit GHZ correlation and GHZ 
paradox 0. 

We start with a brief description of the GHZ paradox, 
which will allow us to present a quantum protocol for 
the three-party DC problem with a detection of multiple 
payments. This three party DC protocol is quite simi¬ 
lar to the protocol presented in Q. We then extend the 
protocol into n-party DC problem without any detection 
of multiple payments. By exploiting this generalized ver¬ 
sion of DC problem we demonstrate a quantum protocol 
for the AV problem. 


II. GHZ PARADOX 


In 1989, Greenberger, Horne and Zeilinger (GHZ) Q 
provided a way to show a direct contradiction of quantum 
mechanics with local realism without using any statistical 
inequality. Consider a three qubit maximally entangle^ 
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known as GHZ states. This GHZ state satisfies the fol¬ 
lowing four constraints 

<yx®(yx®(yx\'^) = (-i)l^) 

ax®(Ty® (yy\'^) = (- 1 - 1)1 ^') 

Uy®Ux® CFy\ 'k) = (-1-1)1 'k) 

(Jy® Uy® ax\'^) = (- 1 - 1)1 ^'), 


( 2 ) 


where, CxjCryjCr^ are the Pauli matrices. Then, one can 
easily show that the above four constraints cannot be 
satisfied simultaneously by any local-realistic (LR) the¬ 
ory [i®- Similarly, for another three-qubit GHZ state 


|vk^) = 


we have. 
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|vk^) = (+l)|vI/-L) 
|vI/^) = (-l)|vI/-L) 

|vI/-^) = (-l)|vI/^) 


( 3 ) 


( 4 ) 


|vI/-") = (-l)|vI/^). 


Like the previous case, the above four constraints also 
cannot be satisfied simultaneously by any LR theory. 


III. QUANTUM DINING CRYPTOGRAPHERS 
(QDC)PROTOCOL 

Imagine that three cryptographers Alice, Bob and 
Gharlie want to play the Dining Gryptographers (DC) 
problem. To do that they first share a number (say 
Li) of copies of the GHZ state | dt) given in ([T]), one 
qubit each from each copy. Here a copy of the states 
corresponds to a run of the protocol. Onward we use 
both the notations copy of the state or run of the protocol 
synonymously. After receiving all the qubits from Li 
copies of GHZ states they randomly select some runs 
(say Lf) and check whether the selected states satisfy 
the GHZ paradox or not. If yes, rest of the shared 
states (say, L = Li \ L 2 ) are genuine copies of GHZ 
state O- The detail of the genuineness check of GHZ 
state is discussed discussed later. After confirmation of 
genuineness of the states the protocol goes as follows: 


Protocol: QDC(3) 


(i): If an even number (be. zero/two) of members 
pay the bill (be., apply a^) then the states 
of all the members of L 2 remain in the same 
GHZ state o as 


I 0 I (g) II ^') = I 4'); IC 
CTz 0 I0 cr^l 'E') = I 4'); cr^ 


7^0(7^14') = !«'); 
icr,,0l|4') = l^*). 


51. Each member performs Gz on his qubits if he wants 
to pay for the dinner otherwise does nothing. 

52. Randomly select a copy of the states to distinguish 
between the cases (i) even and (ii) odd no. of payment(s). 

53. Distinguish ‘no pay’ vs. ‘double pay’ in case (i) 
and ‘single pay’ vs. ‘triple pay’ in case (ii). 


SI: Performing local unitary operation to encode pay¬ 
ment: Alice performs local unitary operation Uz 
on each of her qubits from L if she wishes to pay 
the dinner. Otherwise, she does nothing. Bob and 
Gharlie follow the same. 


(ii): If an odd number (be. one/three) of mem¬ 
bers want to pay for the dinner, the states are 
transformed to | 'k^) given in ([3]) as 

(Tz 0 I 0 I| d') = I I 0 (Jz 0 I| T) = I 

I 0 I 0 (T2| d/) = I (jz® (Tz® iyz\'^) = \ ^^)- 

In the next step of the protocol members distin¬ 
guish between two cases (i) and (ii) without dis¬ 
closing payer(s) identity. 

S2: Distinguishing case (i) and case (ii): To distinguish 
case (i) and case (ii), members randomly select one 
of the run (say ri-th) from L. Now the task is to 
identify the state (| ^') or | d'^)) corresponding to 
the run ri. Thus, the distinguishability task be¬ 
tween case (i) and case (ii) reduces to the problem 
of distinguishability of two orthogonal three-qubit 

GHZ states | d') and | tk-*-) [HI- 

Now the task is to distinguish between subcases 
‘zero pay' vs. ^double pay' for case (i) and ‘single 
pay’ vs. ‘triple pay’ for case (ii). 

S3: Distinguishing between subcases: Members randomly 
selects one of the run (say r 2 -th) from L \ {ri}. 
If case (i) occurs in the previous step then each 
member measures ay on his qubit if (s)he pays for 
the dinner otherwise measures ax- If the product 
of the local measurements is —1 then no member 
has paid for the dinner (be., zero pay) and if the 
product is -|-1 then two members have paid for the 
dinner (be., double pay). The first case follows from 
the top equation of m whereas, the second case 
follows from the last three equations of ([2|). If zero 
pay occurs NSA will pay for the dinner and if double 
pay occurs the payment will be cancelled. 

In case (ii), each member measures ax on his qubit 
if (s)he pays for the dinner otherwise, measures ay. 
If the product of the local measurements is -1-1 then 
all the three members have paid for the dinner (be., 
triple pay) and if the product is —1 then only one 
member has paid for the dinned (be., single pay). 
The first case follows from the first equation of (|3]) 
whereas, the second case follows from the last three 
equations of (|3]). If a single pay occurs payment will 
be accepted otherwise payment will be cancelled. 


Obviously, two copy of the states, one copy for each step, 
are sufficient. Therefore, it is enough if the list L con¬ 
tains just two runs. This is true only if all the mem¬ 
bers honestly follow the entire protocol be., perform local 
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measurements (consistently) whenever asked according 
to their action and declare the true outcomes for each 
such measurement. If they act dishonestly, they do it 
solely to trace payer (s) identity only, and not to create 
any confusion regarding payment. The member who an¬ 
nounces his results last in both the steps S2 and S3 enjoys 
some advantage. (S)He may change the case by just send¬ 
ing a flipped result of her/his measurement outcome. To 
deal with this problem, members choose more than one 
run in both steps S2 and S3 and the ordering of the an¬ 
nouncement of the result is made random for each such 
selected run in both steps. Therefore, no members gets 
the advantage of being last to announce and if someone 
still flips the result, that will lead to an inconsistent con¬ 
clusion and subsequently, they abort the protocol and 
starts a new one with a fresh set of resources. 


A. Security analysis of QDC protocol 


Since the payer(s) information in step SI encoded in¬ 
side the phase of the GHZ state and due to the party 
symmetry of the state no quantum operation can reveal 
the identity of the payer(s). So the local operations for 
distinguishing the cases never disclose any information 
about the payer(s) identity. Step S2 only disclose the 
information whether the total number of payers are odd 
or even. This information in no way harm the purpose, 
rather it helps to detect multiple payments. In step S3 
members only reveal their individual measurement re¬ 
sult and not the choice of measurement to identify the 
‘no pay' in case of (i) and a ‘single pay' in case of (ii). 
By knowing measurement result one cannot predict the 
measurement choice as that would immediately imply a 
violation of causality principle. If two of the members co¬ 
operate to each other then they can certainly predict the 
measurement choice and hence the action of the third 
party by knowing the measurement result. But this is 
quite obvious, since the anonymity exists only among a 
set of possible performers, and if the set is singleton, its 
member is always traceable i.e., no protocol can keep the 
singleton members set untraceable. In our QDC protocol 
if the payment accepted i.e. a ‘single pay' happens then 
no non-payer have any information about the payer. But, 
in case of rejection of payment the identity of payers may 
be disclosed in two cases (i) if the ‘double payment' occurs 
then the non-payer knows that the other two members 
are the payers. This can be avoided if we assume that 
payment is made by one member only like the original 
DC problem and then the protocol will end at step S2. 
Based on the assumption that multiple payments will 
never occur, one can easily generalize our QDC protocol 
for n(> 3) number of members. 


B. Generalized QDC protocol 

Let a group of n cryptographers are sitting for dinner 
at a restaurant and they want to find out whether their 
agency NSA or one of them pays for the dinner, while 
respecting each other’s right to make a payment anony¬ 
mously. To implement the protocol n-cryptographers 
share a copy of the generalized n-qubit GHZ state 

|VI/„) = ^[|000...0)-|III...!)]. (5) 

The above GHZ state has the following correlation: 


o 

o 

o 

dp 

..0)-(-l)‘|lll... 

D] 

Tliooo.. 

.0)-|lll...!)] = 

I'I'n) 

(if t 

is even), 

/jllOOO,, 

.0) + |lll...!)] = 

I'I'n) 

(if t 

is odd), (6) 


where cr* denotes that in t-number of places cr^ acts and 
in rest of the places 2x2 identity matrices I acts. For 
the generalized DC problem with no multiple payments 
t = 0,1. Same kind of protocol with step SI and S2 
as described above will work in this case. By exploiting 
this generalized QDC protocol we now provide a secure 
quantum protocol for the AV problem for odd number of 
parties. Then we extend the result for even number of 
parties. 


IV. QUANTUM ANONYMOUS VETO (QAV) 
PROTOCOL 

Imagine a jury with n members, who need to take an 
unanimous decision, but at the same time want their in¬ 
dividual decisions to remain secret. The generalized GHZ 
state I 4'n) given in ([5]) would allow them to achieve this. 
The quantum AV protocol starts with sharing L {L > 2) 
genuin(j3 copies of | between jury members. Each 
member gets one qubit from each of the copy of | 4'„). 


To check the genuineness of states they randomly select some 
copies of them and run the GHZ-type paradox as described in 
section El 



4 


Protocol: QAV (odd-n) 

SI’. Each member performs on his qubits if he 
wants to vote ‘against’ otherwise, does 
nothing. 

S2’. Performs on qubit associated to a selected 
run to distinguish between the cases 
(i) even (including zero) and (ii) odd no. of 
‘against’ votes. 

S3’. For case (i), distinguish between the cases of 
(a) unanimity ‘in favor’ and (b) an even 
(excluding zero) no. of ‘against’ votes. 

SI’: After receiving all the qubits, each member per¬ 
forms the unitary operation if he is ‘against’ the 
decision and does nothing if he is ‘in favor’, (i) If 
an even number of members (including zero) vote 
‘against’ the decision, all the states remain same 
as I 4'n). (ii) Otherwise, all the states transform to 

S2’: Jury members randomly select one copy of the state 
to distinguish between the cases (i) and (ii) by dis¬ 
tinguishing two orthogonal states [HI- Unanimity 
in favor of the decision happens only if no mem¬ 
bers {i.e. zero members) voted against. Since, (ii) 
represents the case where at least one of the mem¬ 
bers voted against so it does not require any farther 
analysis. But, case (i) represents (a) the unanimity 
‘in favor’ of the decision and (b) an even number 
(2,4,...) of members voted against the decision. 

S3’: To distinguish between subcases (a) and (b) they 
first randomly select one copy of the state and 
each member performs (again) the unitary oper¬ 
ation = i ^ I on his qubit 

\ 0 cos § -I- i sin ^ J 

if he is ‘against’ the decision, otherwise does noth¬ 
ing. (i) If the number (including zero) of members 
against the decision is even multiple of 2 {i.e., mul¬ 
tiple of 2^) then the selected state will remain in 
I 4'n). (ii) Otherwise, {i.e., the number of members 
against the decision is odd multiple of 2) it will 
transform to | di*;);). 

After distinguishing between these two cases, fur¬ 
ther analysis has to be made for case (i) in S3. 

Case (i) represents (la) the unanimity in favor 
of the decision and (lb) multiple of 2^ {i.e., 
4, 8,12,16, 20,...) no. of members voted against 
the decision. 

To distinguish between subcases (la) and (lb), 
they again select another copy and each party 
perform the following unitary operation (Tz(2) = 

) on his respective qubit if he 

is ‘against’ the decision, otherwise does nothing. If 


an even multiple of 2^ no. {i.e., multiple of 2^) of 
members (including zero) are against the decision 
the copy remains unchanged. Otherwise, {i.e., an 
odd multiple of 2^ no. of members excluding zero 
are against the decision) the copy transforms to 
I 4';);). Again these two cases can be distinguished 
by distinguishing the two orthogonal states. 

Jury members keep repeating these steps. In gen¬ 
eral, to distinguish the case of even multiple of 2* 
no. of members (including zero) favouring the de¬ 
cision and the odd multiple of 2* no. of members 
against the decision, the required unitary operation 

will he az{t) = \ |. Since, the 

y 0 cos ^ -I- 1 sin ^ J 

total number of jury members are finite so after 
a finite number of steps they can detect whether 
there is any unanimity ‘in favor’ of the decision. 

Note that in the entire protocol the identity of the 
member giving veto(es) is not revealed. The thing 
that is revealed is the information regarding the 
number of vetoes. Here also the security is guaran¬ 
teed from the genuineness of the GHZ states. 

If the number of jury members n{> 2) is even then mem¬ 
bers share copies of | 4'„+i) where one (say, first) of the 
jury members holds two qubits from each copy. Here, ex¬ 
cept the first jury member all the other members follow 
the similar protocol as described in case of odd no. of 
members. In each run, the first member treats the first 
qubit (from the pair of qubits he received at each run) 
as earlier i.e., performs operation/measurement accord¬ 
ing to his choice of decision and on the second qubit he 
always performs the operations according to decision ‘in 
favor’. Obviously, this arrangement does not provide any 
advantage to the first member and hence does not effect 
the objectivity of the protocol. 


V. GENUINENESS CHECK OF GHZ STATE 

Security of all the protocols described above is 
solemnly dependent on the genuineness of the corre¬ 
sponding GHZ state. Since, one can construct a se¬ 
cure even {n — l)-parties QAV(QDG) protocol from an 
odd n-parties QAV(QDG) protocol so here we describe 
only the genuineness check of GHZ states for odd n. To 
check the genuineness of n(odd)-qubit GHZ state each 
player j{j = 1,2,--- ,n) randomly selects some runs 
Rj (i.e. copies of the shared n-qubit GHZ state) and 
for each r £ Rj he again randomly chooses a operator 
G {Oi}r=o> where 

Oo = cr,), 0 • • • 0 0 CT* 0 0 0 • • • 0 ct” and 

Oi = al ^ ■ 0 al~^ ®(Jy® 0 0 • • • 0 cr", 

for i = 1, 2, • • • ,n with the convention n -|- 1 = 1. The 
upper indices on Pauli matrices represent the identity of 
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the party. Now player j asks player t(t = 1,2,-•• ,n) 
to measure his qubit (associated with the run r) in the 
basis that present in the t-th place of the operator Oj^ 
and send the measurement outcome. Player j collects 
all the local measurement data (including his won mea¬ 
surement result) corresponding to the operator Oj^ and 
checks whether the product of the local measurement re¬ 
sults is equal to the eigenvalue of the eigenvalue equa¬ 
tion 


(7) 


where Xj^ = —1 if Oj^ = Oq otherwise, Xj^ = -1-1. The 
above relations provide a GHZ like contradiction with 
LR-theory for an n-qubit system when n is odd. By em¬ 
ploying relations given in ([7]), one can construct the fol¬ 
lowing LR inequality for n-(odd) two level system. 


O = 




u=i 


< {n-l). 


( 8 ) 


Therefore, if the product of the local measurement 
results associated to the observable Oj^ is equal to the 
eigenvalue Xj^ then the correlation is a genuine n-qubit 
GHZ correlation. 


VI. CONCLUSION 

In conclusion, we present secure quantum protocols for 
both the Dining Cryptographers (DC) problem and the 
Anonymous Veto (AV) problem. The security of these 
protocols are based on GHZ paradox and the properties 
of the GHZ correlation. In our DC protocol, multiple 
payments can be detected whereas no classical protocol 
has this luxury with an unconditional security proof. We 
then generalize the DC problem for n members based 
on the assumption that no multiple payments would oc¬ 
cur. By exploiting this generalized DC problem we have 
shown that the multi-qubit GHZ state allow us to find a 
simple solution for the Anonymous Veto problem. 


The two extreme eigenvalues of the operator 
~ ^o) are ±(n -|- 1) and the corresponding 
eigenstates are | Tn) and | respectively. Therefore, 
only for | Tn) and | 'I';);), the maximum algebraic value 
of O i.e., O is equal to n -I- 1, and hence violets the 
inequality ([5|) maximally. Thus, for odd n the relations 
given in ([7|) uniquely determines the correlation of | Tn). 
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